Third-Party App Management
Overview
The Third-Party Applications page provides a complete inventory of SaaS applications in use across your organization. Discover shadow IT, assess risks, and manage your SaaS portfolio.
Application Inventory
Viewing Applications
Navigate to SaaS → Third-Party Applications
Each application shows:
| Field | Description |
|---|---|
| Name | Application name |
| Category | App type (productivity, finance, etc.) |
| Users | Number of users |
| Risk Level | Security risk rating |
| Status | Approved, pending, blocked |
| Last Used | Most recent access |
Application Details
Click an app to view:
- Overview - App description and website
- Security - Security features and certifications
- Users - Employees using the app
- Permissions - OAuth scopes granted
- History - Usage over time
Discovery
How Apps Are Discovered
| Method | Apps Found |
|---|---|
| OAuth Grants | Apps with API access |
| SSO Logins | Apps accessed via SSO |
| Email Activity | Apps sending notifications |
| Browser Data | Apps accessed via browser |
Discovery Settings
Configure discovery:
- Go to Settings → Discovery
- Enable/disable discovery methods
- Set scan frequency
- Configure exclusions
Risk Assessment
Risk Scoring
Apps are scored on:
| Factor | Weight |
|---|---|
| Security Certifications | SOC 2, ISO 27001 |
| Data Handling | Encryption, retention |
| Access Controls | MFA, SSO support |
| Company Profile | Size, age, reputation |
| Permissions Requested | OAuth scopes |
Risk Levels
| Level | Score | Description |
|---|---|---|
| Low | 0-3 | Minimal security concerns |
| Medium | 4-6 | Some concerns, review needed |
| High | 7-8 | Significant concerns |
| Critical | 9-10 | Major security risks |
Manual Assessment
Override automated scores:
- Open application
- Click Edit Assessment
- Adjust risk factors
- Add notes
- Save
Application Status
Status Options
| Status | Meaning |
|---|---|
| Approved | Authorized for use |
| Pending | Awaiting review |
| Blocked | Not authorized |
| Under Review | Being evaluated |
Changing Status
- Select application(s)
- Click Change Status
- Select new status
- Add reason
- Confirm
Bulk Actions
Manage multiple apps:
- Bulk approve
- Bulk block
- Bulk assign for review
User Management
Viewing App Users
See who uses each app:
- User list
- Access level/role
- Last access date
- Total usage time
Revoking Access
Remove user access:
- Open application
- Go to Users tab
- Select user(s)
- Click Revoke Access
- Confirm revocation
Revoking access may require action in the connected identity provider or the application itself.
OAuth Permissions
Understanding Permissions
OAuth apps request permissions (scopes):
| Permission | Risk |
|---|---|
| Read email | Medium - can see email content |
| Send email | High - can send as user |
| Access files | High - can read documents |
| Manage users | Critical - admin access |
Reviewing Permissions
- Open application
- Go to Permissions tab
- Review requested scopes
- Assess necessity and risk
Revoking OAuth Tokens
Revoke app access entirely:
- Open application
- Click Revoke OAuth Access
- Confirm revocation
- Access removed across all users
Categories
Application Categories
| Category | Examples |
|---|---|
| Productivity | Notion, Asana, Monday |
| Communication | Slack, Zoom, Teams |
| Development | GitHub, Jira, Figma |
| Finance | QuickBooks, Expensify |
| Marketing | HubSpot, Mailchimp |
| Security | 1Password, LastPass |
| Storage | Dropbox, Box, Google Drive |
Custom Categories
Create custom categories:
- Go to Settings → Categories
- Click Add Category
- Enter name and description
- Assign apps to category
Alerts
Alert Configuration
Set up alerts for:
| Alert Type | Trigger |
|---|---|
| New App | New application discovered |
| High Risk | High-risk app detected |
| Sensitive Access | Sensitive permissions granted |
| Excessive Users | App exceeds user threshold |
Managing Alerts
- Go to Settings → Alerts
- Enable desired alert types
- Configure recipients
- Set frequency
Reporting
Available Reports
- App Inventory - Complete application list
- Risk Summary - Apps by risk level
- User Access - Who uses what
- Trend Report - Changes over time
- Shadow IT - Unapproved applications
Export Options
- PDF report
- Excel spreadsheet
- CSV data
Compliance
SaaS management supports:
| Framework | Requirement |
|---|---|
| SOC 2 | CC6.7 |
| ISO 27001 | A.13.2.4 |
| GDPR | Art. 28 (processors) |
Best Practices
Create Clear Policies
Define what makes an app "approved" and communicate to employees.
Review High-Risk First
Prioritize review of high-risk and high-user apps.
Provide Alternatives
When blocking an app, suggest approved alternatives to avoid friction.
Monitor Continuously
New apps appear regularly. Continuous monitoring catches shadow IT.